Fix Local File Inclusion in Rack::Static

[odaysec]

Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly. By exploiting this vulnerability, an attacker can gain access to all files under the specified root: directory, provided they are able to determine then path of the file.

Mitigation

• Update to the latest version of Rack
• Remove usage of Rack::Static
• Ensure that root: points at a directory path which only contains files which should be accessed publicly.

CWE-23
CVE-2025-27610

[mitchellhenke]

Closing as a duplicate of #11996